81% of leaked API keys Truffle Security reported still worked six months later. Now it wants key issuers to revoke them directly

A leaked key keeps working until the company that issued it turns it off, and most never get turned off.

What happened

Truffle Security launched its Secrets Revocation Program on November 4. It says it has confirmed 1.4 million live secrets leaked since 2022 across GitHub, Docker Hub, npm, Hugging Face and other public sources, and it is inviting every company that issues API keys to revoke them for free.

The reason is blunt. Last year Truffle reported 21,981 live keys it found on GitLab and Bitbucket. Six months later, 81% still worked. Issuers can either give Truffle a revocation endpoint so keys die as soon as they are verified, or receive verified keys by webhook and revoke them within 14 days. Sixteen issuers have joined, including Vercel, Hugging Face, Notion, Resend, RubyGems and Twilio.

Two findings matter for anyone using AI coding tools. Since January 2025, Truffle found 2,655 working keys in AI coding tools' config files, including a GitLab token inside .claude/settings.local.json in a published Docker image. And by May 2026, 6.8% of commits that leaked a working key were signed by an AI coding agent, up from none before mid 2025. Three out of four Resend keys it delivered came from Docker images, not repos.

My take

An automation stack is a pile of keys: CRM, email, SMS, payment, model APIs. Every one is a credential someone can use if it leaks, and this data says nobody will turn it off for you.

What I do on client builds:

1. Keep secrets in the platform's credential store, never in workflow JSON, exported templates or config files.
2. Add AI tool folders like .claude and any .env files to .dockerignore and .gitignore before the first build.
3. Run a secret scanner on images and repos before anything is published.
4. Issue one key per client per integration, so revoking one does not break five workflows.
5. Keep a list of every key, where it lives and the exact page where you revoke it.

Point 5 is the one most teams skip, and it is the one you need at 2 AM when a key shows up in public.

I build automations with that inventory in place from day one. If you want a second pair of eyes on how your keys are stored, see what I do at romielwillautomate.dev.